{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "jpadilla pyjwt: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/jpadilla--pyjwt/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/jpadilla--pyjwt/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in Chainguard (authentik-fips-2026.5 2026.5.7-r7 and 6 more)",
   "content_text": "Fixed versions: authentik-fips-2026.5 2026.5.7-r7, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103001/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103001/",
   "title": "CVE-2026-103001 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-30T21:15:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102265/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102265/",
   "title": "CVE-2026-102265 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:48:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102265/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102265/",
   "title": "CVE-2026-102265 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 68 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:48:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102265/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102265/",
   "title": "CVE-2026-102265 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:48:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102265/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102265/",
   "title": "CVE-2026-102265 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:48:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102265/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102265/",
   "title": "CVE-2026-102265 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 9 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:48:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Chainguard (awx 24.6.1-r67 and 26 more)",
   "content_text": "Fixed versions: awx 24.6.1-r67, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion-fips 1.7.0.1-r2, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, lmcache-cuda-13.0 0.5.5-r1, openstack-glance-2025.1-fips 30.2.0_git20260928-r4, openstack-glance-2025.2-fips 31.1.0_git20260925-r4, openstack-horizon-2025.1 25.3.2_git20260617-r18, openstack-horizon-2025.1-fips 25.3.2_git20260617-r17, openstack-horizon-2025.2 25.5.2_git20260914-r7, openstack-horizon-2025.2-fips 25.5.2_git20260914-r7, openstack-horizon-2026.1 25.7.3_git20260924-r7, openstack-horizon-2026.1-fips 25.7.3_git20261001-r4, openstack-nova-2025.1 31.3.0_git20260717-r16, openstack-nova-2025.2 32.2.0_git20260715-r17, openstack-placement-2025.1-fips 13.0.0_git20260916-r7, openstack-placement-2025.2-fips 14.0.0_git20260916-r7, openstack-placement-2026.1-fips 15.0.0_git20260812-r12, py3.12-airflow-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r5, py3.13-airflow-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r5, py3.14-airflow-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r5, wazuh-manager-framework 4.14.8-r5, wazuh-manager-framework-fips 4.14.8-r3.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.15.0-1)",
   "content_text": "Fixed versions: pyjwt 2.15.0-1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.15.0.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.6)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.6.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.4)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.4.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.3)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.3.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1.1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.1.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm4.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm4.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102275/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102275/",
   "title": "CVE-2026-102275 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm4.",
   "date_published": "2026-09-28T20:46:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Chainguard (airflow-2 2.11.2-r25 and 71 more)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r25, airflow-core-2 2.11.2-r10, authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-horizon-2026.1-fips 25.7.3_git20260924-r2, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.6)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.6.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.4)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.4.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.3)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.3.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1.1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.1.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm4.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm4.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm4)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm4.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102274/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102274/",
   "title": "CVE-2026-102274 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 10 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:42:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 69 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 9 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 68 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-nova-2026.1 33.0.1_git20260819-r12, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 8 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Chainguard (airflow-2 2.11.2-r25 and 75 more)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r25, airflow-core-2 2.11.2-r10, authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http 1.5.1-r10, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2 28.0.1_git20260902-r5, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-nova-2026.1 33.0.1_git20260819-r12, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 10 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed in Chainguard (authentik-fips-2026.5 2026.5.7-r7 and 6 more)",
   "content_text": "Fixed versions: authentik-fips-2026.5 2026.5.7-r7, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:29:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102270/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102270/",
   "title": "CVE-2026-102270 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:29:24Z"
  }
 ]
}